@zola_do/authorization 0.3.6 → 0.3.7

package/README.md

@@ -169,9 +169,10 @@ export class ProtectedController {}
 
 ### OptionalJwtGuard
 
-Allows anonymous access but extracts user if token is present:
+Allows anonymous access but extracts user if token is present. **`AuthorizationModule` registers global `JwtGuard`**, so also mark the route `@AllowAnonymous()` or the global guard returns 401 before this runs.
 
 ```typescript
+@AllowAnonymous()
 @UseGuards(OptionalJwtGuard)
 @Controller('optional')
 export class OptionalController {
@@ -187,7 +188,7 @@ export class OptionalController {
 
 ### PermissionsGuard
 
-Requires specific permissions. Supports pipe-separated OR logic:
+Requires specific permissions. Supports pipe-separated OR logic. Routes marked `@AllowAnonymous()` skip permission checks entirely. On protected routes, you must pass a non-empty permission string — `PermissionsGuard('')` returns 403. Omit the guard when you only need JWT (`JwtGuard` global). CRUD factories skip `PermissionsGuard` when `*Permission` is unset.
 
 ```typescript
 @UseGuards(JwtGuard, PermissionsGuard('product:create'))
@@ -359,25 +360,22 @@ export class AuthController {
 
 ## Custom JwtGuard Override
 
-Override the default JWT validation logic:
+Extend `JwtGuard` to add checks after library verification (for example suspended accounts):
 
 ```typescript
-import { Injectable, ExecutionContext } from '@nestjs/common';
+import { ForbiddenException, Injectable, ExecutionContext } from '@nestjs/common';
 import { JwtGuard } from '@zola_do/authorization';
 
 @Injectable()
 export class AppJwtGuard extends JwtGuard {
   async canActivate(context: ExecutionContext): Promise<boolean> {
-    // Run default validation
     const canActivate = await super.canActivate(context);
     if (!canActivate) return false;
 
-    // Add custom logic
     const request = context.switchToHttp().getRequest();
     const user = request.user;
 
-    // Check additional conditions
-    if (user.status === 'suspended') {
+    if (user?.status === 'suspended') {
       throw new ForbiddenException('Account suspended');
     }
 
@@ -386,7 +384,7 @@ export class AppJwtGuard extends JwtGuard {
 }
 ```
 
-Register in module:
+Register in module (stacks a second global guard on top of `AuthorizationModule`'s default):
 
 ```typescript
 import { APP_GUARD } from '@nestjs/core';
@@ -403,6 +401,8 @@ import { AuthorizationModule, JwtGuard } from '@zola_do/authorization';
 export class AppModule {}
 ```
 
+After `super.canActivate()`, `request.user` is the verified JWT payload. The library sets `Symbol.for('zola.auth.verified')` so a stacked guard does not re-parse the Bearer token. **Do not** set `req.user` in middleware to skip JWT unless you verified the token yourself and call `markJwtVerified(req)` from `@zola_do/authorization`.
+
 ## Strategies
 
 ### JwtStrategy
@@ -438,7 +438,7 @@ import { JwtRefreshTokenStrategy } from '@zola_do/authorization';
 | `JWT_ALGORITHM`             | HMAC signing algorithm (`HS256`, `HS384`, `HS512`) | `HS256` |
 | `API_KEY`                   | API key for ApiKeyGuard      | Optional |
 
-`AuthorizationModule` calls `validateJwtEnv()` on startup. Import `validateJwtEnv` for explicit checks before bootstrap, or pass `{ required: false }` to skip when JWT is intentionally disabled.
+`AuthorizationModule` calls `validateJwtEnv()` on startup (requires distinct access/refresh secrets ≥32 chars and `JWT_*_EXPIRES`). Import `validateJwtEnv` for explicit checks before bootstrap, or pass `{ required: false }` to skip when JWT is intentionally disabled.
 
 ### Client IP behind a reverse proxy
 
@@ -531,7 +531,7 @@ Requires `@nestjs/throttler` peer dependency.
 | Guard                           | Description             | Auth Required        |
 | ------------------------------- | ----------------------- | -------------------- |
 | `JwtGuard`                      | Bearer token validation | Yes (global default) |
-| `OptionalJwtGuard`              | Bearer token if present | No                   |
+| `OptionalJwtGuard`              | Bearer token if present | No (pair with `@AllowAnonymous()` when `JwtGuard` is global) |
 | `PermissionsGuard(permissions)` | Permission check        | Yes                  |
 | `ApiKeyGuard`                   | API key validation      | Yes                  |
 | `VendorGuard()`                 | Vendor status check     | Yes                  |

package/dist/decorators/current-user.decorator.js

@@ -2,8 +2,12 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CurrentUser = void 0;
 const common_1 = require("@nestjs/common");
-exports.CurrentUser = (0, common_1.createParamDecorator)((data, ctx) => {
+exports.CurrentUser = (0, common_1.createParamDecorator)((property, ctx) => {
     const request = ctx.switchToHttp().getRequest();
-    return request.user;
+    const user = request.user;
+    if (property && user != null) {
+        return user[property];
+    }
+    return user;
 });
 //# sourceMappingURL=current-user.decorator.js.map

package/dist/decorators/current-user.decorator.js.map

@@ -1 +1 @@
-{"version":3,"file":"current-user.decorator.js","sourceRoot":"","sources":["../../src/decorators/current-user.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAAwE;AAE3D,QAAA,WAAW,GAAG,IAAA,6BAAoB,EAC7C,CAAC,IAAa,EAAE,GAAqB,EAAE,EAAE;IACvC,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;IAEhD,OAAO,OAAO,CAAC,IAAI,CAAC;AACtB,CAAC,CACF,CAAC"}
+{"version":3,"file":"current-user.decorator.js","sourceRoot":"","sources":["../../src/decorators/current-user.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAAwE;AAE3D,QAAA,WAAW,GAAG,IAAA,6BAAoB,EAC7C,CAAC,QAA4B,EAAE,GAAqB,EAAE,EAAE;IACtD,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAE1B,IAAI,QAAQ,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CACF,CAAC"}

package/dist/guards/api-key.guard.js

@@ -32,12 +32,13 @@ let ApiKeyGuard = class ApiKeyGuard {
         }
     }
     timingSafeCompare(provided, expected) {
-        const providedBuffer = Buffer.from(provided);
-        const expectedBuffer = Buffer.from(expected);
-        if (providedBuffer.length !== expectedBuffer.length) {
-            return false;
-        }
-        return (0, crypto_1.timingSafeEqual)(providedBuffer, expectedBuffer);
+        const providedDigest = (0, crypto_1.createHmac)('sha256', 'zola.api-key-compare')
+            .update(provided)
+            .digest();
+        const expectedDigest = (0, crypto_1.createHmac)('sha256', 'zola.api-key-compare')
+            .update(expected)
+            .digest();
+        return (0, crypto_1.timingSafeEqual)(providedDigest, expectedDigest);
     }
 };
 exports.ApiKeyGuard = ApiKeyGuard;

package/dist/guards/api-key.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-key.guard.js","sourceRoot":"","sources":["../../src/guards/api-key.guard.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAKwB;AACxB,mCAAyC;AAGlC,IAAM,WAAW,GAAjB,MAAM,WAAW;IACtB,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YACpD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;YAChC,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;YACpC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC1C,MAAM,IAAI,8BAAqB,CAAC,sBAAsB,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YAC1C,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,8BAAqB,CAAC,wBAAwB,CAAC,CAAC;YAC5D,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;gBACnD,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;YACrD,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,QAAgB,EAAE,QAAgB;QAC1D,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE7C,IAAI,cAAc,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAA,wBAAe,EAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IACzD,CAAC;CACF,CAAA;;sBAnCY,WAAW;IADvB,IAAA,mBAAU,GAAE;GACA,WAAW,CAmCvB"}
+{"version":3,"file":"api-key.guard.js","sourceRoot":"","sources":["../../src/guards/api-key.guard.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAKwB;AACxB,mCAAqD;AAG9C,IAAM,WAAW,GAAjB,MAAM,WAAW;IACtB,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YACpD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;YAChC,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;YACpC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC1C,MAAM,IAAI,8BAAqB,CAAC,sBAAsB,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YAC1C,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,8BAAqB,CAAC,wBAAwB,CAAC,CAAC;YAC5D,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;gBACnD,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;YACrD,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,QAAgB,EAAE,QAAgB;QAC1D,MAAM,cAAc,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,sBAAsB,CAAC;aAChE,MAAM,CAAC,QAAQ,CAAC;aAChB,MAAM,EAAE,CAAC;QACZ,MAAM,cAAc,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,sBAAsB,CAAC;aAChE,MAAM,CAAC,QAAQ,CAAC;aAChB,MAAM,EAAE,CAAC;QAEZ,OAAO,IAAA,wBAAe,EAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IACzD,CAAC;CACF,CAAA;;sBAnCY,WAAW;IADvB,IAAA,mBAAU,GAAE;GACA,WAAW,CAmCvB"}

package/dist/guards/jwt.guard.d.ts

@@ -6,5 +6,4 @@ export declare class JwtGuard implements CanActivate {
     private readonly authHelper;
     constructor(reflector: Reflector, authHelper: AuthHelper);
     canActivate(context: ExecutionContext): Promise<boolean>;
-    private extractTokenFromHeader;
 }

package/dist/guards/jwt.guard.js

@@ -14,6 +14,7 @@ const common_1 = require("@nestjs/common");
 const core_1 = require("@nestjs/core");
 const allow_anonymous_decorator_1 = require("../decorators/allow-anonymous.decorator");
 const auth_helper_1 = require("../helper/auth.helper");
+const jwt_request_helper_1 = require("../helper/jwt-request.helper");
 let JwtGuard = class JwtGuard {
     constructor(reflector, authHelper) {
         this.reflector = reflector;
@@ -22,8 +23,12 @@ let JwtGuard = class JwtGuard {
     async canActivate(context) {
         var _a;
         try {
-            const request = context.switchToHttp().getRequest();
-            if (request === null || request === void 0 ? void 0 : request.user) {
+            const request = (0, jwt_request_helper_1.getHttpRequest)(context);
+            if (!request) {
+                return true;
+            }
+            const token = (0, jwt_request_helper_1.extractBearerToken)(request);
+            if ((0, jwt_request_helper_1.isJwtVerified)(request) && !token) {
                 return true;
             }
             const isAnonymousAllowed = (_a = this.reflector) === null || _a === void 0 ? void 0 : _a.getAllAndOverride(allow_anonymous_decorator_1.ALLOW_ANONYMOUS_META_KEY, [context.getHandler(), context.getClass()]);
@@ -31,7 +36,6 @@ let JwtGuard = class JwtGuard {
                 request.isAnonymous = true;
                 return true;
             }
-            const token = this.extractTokenFromHeader(request);
             if (!token) {
                 throw new common_1.UnauthorizedException('JsonWebTokenError', 'jwt must be provided');
             }
@@ -41,18 +45,13 @@ let JwtGuard = class JwtGuard {
             }
             const user = await this.authHelper.verify(token, secret);
             request.user = user;
+            (0, jwt_request_helper_1.markJwtVerified)(request);
             return true;
         }
         catch (error) {
             throw error;
         }
     }
-    extractTokenFromHeader(request) {
-        var _a;
-        var _b;
-        const [type, token] = (_b = (_a = request.headers.authorization) === null || _a === void 0 ? void 0 : _a.split(' ')) !== null && _b !== void 0 ? _b : [];
-        return type === 'Bearer' ? token : undefined;
-    }
 };
 exports.JwtGuard = JwtGuard;
 exports.JwtGuard = JwtGuard = __decorate([

package/dist/guards/jwt.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.guard.js","sourceRoot":"","sources":["../../src/guards/jwt.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAKwB;AAExB,uCAAyC;AACzC,uFAAmF;AACnF,uDAAmD;AAG5C,IAAM,QAAQ,GAAd,MAAM,QAAQ;IACnB,YACmB,SAAoB,EACpB,UAAsB;yBADtB,SAAS;0BACT,UAAU;IAC1B,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;;QACzC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YAIpD,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,EAAE,CAAC;gBAClB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,kBAAkB,GAAG,MAAA,IAAI,CAAC,SAAS,0CAAE,iBAAiB,CAC1D,oDAAwB,EACxB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;YACF,IAAI,kBAAkB,EAAE,CAAC;gBACvB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;gBAC3B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,8BAAqB,CAC7B,mBAAmB,EACnB,sBAAsB,CACvB,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;YACnD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,8BAAqB,CAC7B,oBAAoB,EACpB,2CAA2C,CAC5C,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAEzD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,sBAAsB,CAAC,OAAgB;;;QAC7C,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,SAAG,MAAA,OAAO,CAAC,OAAO,CAAC,aAAa,0CAAE,KAAK,CAAC,GAAG,CAAC,mCAAI,EAAE,CAAC;QACtE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC;CACF,CAAA;;mBAtDY,QAAQ;IADpB,IAAA,mBAAU,GAAE;qCAGmB,gBAAS,EACR,wBAAU;GAH9B,QAAQ,CAsDpB"}
+{"version":3,"file":"jwt.guard.js","sourceRoot":"","sources":["../../src/guards/jwt.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAKwB;AACxB,uCAAyC;AACzC,uFAAmF;AACnF,uDAAmD;AACnD,qEAKsC;AAG/B,IAAM,QAAQ,GAAd,MAAM,QAAQ;IACnB,YACmB,SAAoB,EACpB,UAAsB;yBADtB,SAAS;0BACT,UAAU;IAC1B,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;;QACzC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAA,mCAAc,EAAC,OAAO,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,KAAK,GAAG,IAAA,uCAAkB,EAAC,OAAO,CAAC,CAAC;YAG1C,IAAI,IAAA,kCAAa,EAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,kBAAkB,GAAG,MAAA,IAAI,CAAC,SAAS,0CAAE,iBAAiB,CAC1D,oDAAwB,EACxB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;YACF,IAAI,kBAAkB,EAAE,CAAC;gBACtB,OAAe,CAAC,WAAW,GAAG,IAAI,CAAC;gBACpC,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,8BAAqB,CAC7B,mBAAmB,EACnB,sBAAsB,CACvB,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;YACnD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,8BAAqB,CAC7B,oBAAoB,EACpB,2CAA2C,CAC5C,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAEzD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,IAAA,oCAAe,EAAC,OAAO,CAAC,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF,CAAA;;mBArDY,QAAQ;IADpB,IAAA,mBAAU,GAAE;qCAGmB,gBAAS,EACR,wBAAU;GAH9B,QAAQ,CAqDpB"}

package/dist/guards/optional-jwt.guard.d.ts

@@ -4,5 +4,4 @@ export declare class OptionalJwtGuard implements CanActivate {
     private readonly authHelper;
     constructor(authHelper: AuthHelper);
     canActivate(context: ExecutionContext): Promise<boolean>;
-    private extractTokenFromHeader;
 }

package/dist/guards/optional-jwt.guard.js

@@ -12,17 +12,21 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.OptionalJwtGuard = void 0;
 const common_1 = require("@nestjs/common");
 const auth_helper_1 = require("../helper/auth.helper");
+const jwt_request_helper_1 = require("../helper/jwt-request.helper");
 let OptionalJwtGuard = class OptionalJwtGuard {
     constructor(authHelper) {
         this.authHelper = authHelper;
     }
     async canActivate(context) {
         try {
-            const request = context.switchToHttp().getRequest();
-            if (request === null || request === void 0 ? void 0 : request.user) {
+            const request = (0, jwt_request_helper_1.getHttpRequest)(context);
+            if (!request) {
+                return true;
+            }
+            const token = (0, jwt_request_helper_1.extractBearerToken)(request);
+            if ((0, jwt_request_helper_1.isJwtVerified)(request) && !token) {
                 return true;
             }
-            const token = this.extractTokenFromHeader(request);
             if (!token) {
                 return true;
             }
@@ -32,18 +36,13 @@ let OptionalJwtGuard = class OptionalJwtGuard {
             }
             const user = await this.authHelper.verify(token, secret);
             request.user = user;
+            (0, jwt_request_helper_1.markJwtVerified)(request);
             return true;
         }
         catch (error) {
             throw error;
         }
     }
-    extractTokenFromHeader(request) {
-        var _a;
-        var _b;
-        const [type, token] = (_b = (_a = request.headers.authorization) === null || _a === void 0 ? void 0 : _a.split(' ')) !== null && _b !== void 0 ? _b : [];
-        return type === 'Bearer' ? token : undefined;
-    }
 };
 exports.OptionalJwtGuard = OptionalJwtGuard;
 exports.OptionalJwtGuard = OptionalJwtGuard = __decorate([

package/dist/guards/optional-jwt.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"optional-jwt.guard.js","sourceRoot":"","sources":["../../src/guards/optional-jwt.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAKwB;AAExB,uDAAmD;AAG5C,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,YAA6B,UAAsB;0BAAtB,UAAU;IAAe,CAAC;IAEvD,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YACpD,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,EAAE,CAAC;gBAClB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;YACnD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,8BAAqB,CAC7B,oBAAoB,EACpB,2CAA2C,CAC5C,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAEzD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,sBAAsB,CAAC,OAAgB;;;QAC7C,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,SAAG,MAAA,OAAO,CAAC,OAAO,CAAC,aAAa,0CAAE,KAAK,CAAC,GAAG,CAAC,mCAAI,EAAE,CAAC;QACtE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC;CACF,CAAA;;2BApCY,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;qCAE8B,wBAAU;GADxC,gBAAgB,CAoC5B"}
+{"version":3,"file":"optional-jwt.guard.js","sourceRoot":"","sources":["../../src/guards/optional-jwt.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAKwB;AACxB,uDAAmD;AACnD,qEAKsC;AAG/B,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,YAA6B,UAAsB;0BAAtB,UAAU;IAAe,CAAC;IAEvD,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAA,mCAAc,EAAC,OAAO,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,KAAK,GAAG,IAAA,uCAAkB,EAAC,OAAO,CAAC,CAAC;YAE1C,IAAI,IAAA,kCAAa,EAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;YACnD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,8BAAqB,CAC7B,oBAAoB,EACpB,2CAA2C,CAC5C,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAEzD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,IAAA,oCAAe,EAAC,OAAO,CAAC,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF,CAAA;;2BArCY,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;qCAE8B,wBAAU;GADxC,gBAAgB,CAqC5B"}

package/dist/guards/permissions.guard.d.ts

@@ -1,2 +1,2 @@
 import { CanActivate, Type } from '@nestjs/common';
-export declare function PermissionsGuard(permissions: string): Type<CanActivate>;
+export declare function PermissionsGuard(permissions?: string): Type<CanActivate>;

package/dist/guards/permissions.guard.js

@@ -1,23 +1,60 @@
 "use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PermissionsGuard = PermissionsGuard;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const allow_anonymous_decorator_1 = require("../decorators/allow-anonymous.decorator");
+const jwt_request_helper_1 = require("../helper/jwt-request.helper");
+function parseRequiredPermissions(permissions) {
+    const trimmed = (permissions !== null && permissions !== void 0 ? permissions : '').trim();
+    if (!trimmed) {
+        return [];
+    }
+    return trimmed
+        .split('|')
+        .map((part) => part.trim())
+        .filter((part) => part.length > 0);
+}
 function PermissionsGuard(permissions) {
-    class PermissionsGuardMixin {
+    let PermissionsGuardMixin = class PermissionsGuardMixin {
+        constructor(reflector) {
+            this.reflector = reflector;
+        }
         canActivate(context) {
-            const request = context.switchToHttp().getRequest();
-            if (!permissions || request.isAnonymous) {
+            var _a;
+            const request = (0, jwt_request_helper_1.getHttpRequest)(context);
+            if (!request) {
                 return true;
             }
-            const requiredPermissions = permissions.split('|');
-            if (requiredPermissions.length < 1) {
+            const isAnonymousAllowed = (_a = this.reflector) === null || _a === void 0 ? void 0 : _a.getAllAndOverride(allow_anonymous_decorator_1.ALLOW_ANONYMOUS_META_KEY, [context.getHandler(), context.getClass()]);
+            if (isAnonymousAllowed) {
                 return true;
             }
+            const requiredPermissions = parseRequiredPermissions(permissions);
+            if (requiredPermissions.length === 0) {
+                return false;
+            }
             const user = request.user;
-            const userPermissions = user === null || user === void 0 ? void 0 : user.permissions;
-            const isAllowed = requiredPermissions.some((requiredPermission) => userPermissions === null || userPermissions === void 0 ? void 0 : userPermissions.find((x) => x === requiredPermission.trim()));
-            return isAllowed;
+            if (!user || !(0, jwt_request_helper_1.isJwtVerified)(request)) {
+                return false;
+            }
+            const userPermissions = user.permissions;
+            return requiredPermissions.some((requiredPermission) => userPermissions === null || userPermissions === void 0 ? void 0 : userPermissions.find((x) => x === requiredPermission));
         }
-    }
+    };
+    PermissionsGuardMixin = __decorate([
+        (0, common_1.Injectable)(),
+        __metadata("design:paramtypes", [core_1.Reflector])
+    ], PermissionsGuardMixin);
     return PermissionsGuardMixin;
 }
 //# sourceMappingURL=permissions.guard.js.map

package/dist/guards/permissions.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.guard.js","sourceRoot":"","sources":["../../src/guards/permissions.guard.ts"],"names":[],"mappings":";;;AAEA,0BAAiC,WAAmB;IAClD,MAAM,qBAAqB;QACzB,WAAW,CAAC,OAAyB;YACnC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YAEpD,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;gBACxC,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,mBAAmB,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnD,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnC,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,IAAI,GAAQ,OAAO,CAAC,IAAI,CAAC;YAC/B,MAAM,eAAe,GAAG,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,WAAW,CAAC;YAE1C,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,kBAAkB,EAAE,EAAE,CAChE,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,KAAK,kBAAkB,CAAC,IAAI,EAAE,CAAC,CACtE,CAAC;YAEF,OAAO,SAAS,CAAC;QACnB,CAAC;KACF;IAED,OAAO,qBAAqB,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"permissions.guard.js","sourceRoot":"","sources":["../../src/guards/permissions.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAKwB;AACxB,uCAAyC;AACzC,uFAAmF;AACnF,qEAA6E;AAE7E,SAAS,wBAAwB,CAAC,WAAoB;IACpD,MAAM,OAAO,GAAG,CAAC,WAAW,aAAX,WAAW,cAAX,WAAW,GAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,OAAO;SACX,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,0BAAiC,WAAoB;IACnD,IACM,qBAAqB,GAD3B,MACM,qBAAqB;QACzB,YAA6B,SAAoB;6BAApB,SAAS;QAAc,CAAC;QAErD,WAAW,CAAC,OAAyB;;YACnC,MAAM,OAAO,GAAG,IAAA,mCAAc,EAAC,OAAO,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,kBAAkB,GAAG,MAAA,IAAI,CAAC,SAAS,0CAAE,iBAAiB,CAC1D,oDAAwB,EACxB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;YACF,IAAI,kBAAkB,EAAE,CAAC;gBACvB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;YAClE,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrC,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,IAAI,GAAQ,OAAO,CAAC,IAAI,CAAC;YAC/B,IAAI,CAAC,IAAI,IAAI,CAAC,IAAA,kCAAa,EAAC,OAAO,CAAC,EAAE,CAAC;gBACrC,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,CAAC;YAEzC,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,kBAAkB,EAAE,EAAE,CACrD,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAC/D,CAAC;QACJ,CAAC;KACF,CAAA;IAjCK,qBAAqB;QAD1B,IAAA,mBAAU,GAAE;yCAE6B,gBAAS;OAD7C,qBAAqB,CAiC1B;IAED,OAAO,qBAAqB,CAAC;AAC/B,CAAC"}

package/dist/guards/vendor.guard.js

@@ -2,13 +2,25 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VendorGuard = VendorGuard;
 const common_1 = require("@nestjs/common");
+const hasOrganizationId = (organization) => {
+    if ((organization === null || organization === void 0 ? void 0 : organization.id) == null) {
+        return false;
+    }
+    return String(organization.id).trim() !== '';
+};
+const isVendorRegistered = (user) => {
+    const organization = user === null || user === void 0 ? void 0 : user.organization;
+    if (!hasOrganizationId(organization)) {
+        return false;
+    }
+    return false;
+};
 function VendorGuard() {
     class VendorGuardMixin {
         canActivate(context) {
             const request = context.switchToHttp().getRequest();
             const user = request.user;
-            const organization = user === null || user === void 0 ? void 0 : user.organization;
-            if ((organization === null || organization === void 0 ? void 0 : organization.id) != null) {
+            if (isVendorRegistered(user)) {
                 return true;
             }
             throw new common_1.ForbiddenException('vendor_registration_not_completed');

package/dist/guards/vendor.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"vendor.guard.js","sourceRoot":"","sources":["../../src/guards/vendor.guard.ts"],"names":[],"mappings":";;;AAAA,2CAKwB;AAExB;IACE,MAAM,gBAAgB;QACpB,WAAW,CAAC,OAAyB;YACnC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YACpD,MAAM,IAAI,GAAQ,OAAO,CAAC,IAAI,CAAC;YAC/B,MAAM,YAAY,GAAG,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,YAAY,CAAC;YAExC,IAAI,CAAA,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,EAAE,KAAI,IAAI,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,IAAI,2BAAkB,CAAC,mCAAmC,CAAC,CAAC;QACpE,CAAC;KACF;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"vendor.guard.js","sourceRoot":"","sources":["../../src/guards/vendor.guard.ts"],"names":[],"mappings":";;;AAAA,2CAKwB;AAQxB,MAAM,iBAAiB,GAAG,CAAC,YAAiB,EAAW,EAAE;IACvD,IAAI,CAAA,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,EAAE,KAAI,IAAI,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AAC/C,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,IAAS,EAAW,EAAE;IAChD,MAAM,YAAY,GAAG,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,YAAY,CAAC;IACxC,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACf,CAAC;IAgBD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;IACE,MAAM,gBAAgB;QACpB,WAAW,CAAC,OAAyB;YACnC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YACpD,MAAM,IAAI,GAAQ,OAAO,CAAC,IAAI,CAAC;YAE/B,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,IAAI,2BAAkB,CAAC,mCAAmC,CAAC,CAAC;QACpE,CAAC;KACF;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC"}

package/dist/guards/webhook-signature.guard.d.ts

@@ -4,4 +4,5 @@ export type WebhookSignatureGuardOptions = {
     headerName?: string;
     algorithm?: 'sha256' | 'sha512';
 };
+export declare function resolveWebhookRawBody(rawBody: unknown): string | Buffer;
 export declare function WebhookSignatureGuard(options?: WebhookSignatureGuardOptions): Type<CanActivate>;

package/dist/guards/webhook-signature.guard.js

@@ -6,9 +6,17 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveWebhookRawBody = resolveWebhookRawBody;
 exports.WebhookSignatureGuard = WebhookSignatureGuard;
 const common_1 = require("@nestjs/common");
 const crypto_1 = require("crypto");
+const jwt_request_helper_1 = require("../helper/jwt-request.helper");
+function resolveWebhookRawBody(rawBody) {
+    if (typeof rawBody === 'string' || Buffer.isBuffer(rawBody)) {
+        return rawBody;
+    }
+    throw new common_1.UnauthorizedException('webhook_raw_body_required');
+}
 function WebhookSignatureGuard(options = {}) {
     var _a, _b, _c;
     const secretEnvVar = (_a = options.secretEnvVar) !== null && _a !== void 0 ? _a : 'WEBHOOK_SIGNING_SECRET';
@@ -17,8 +25,10 @@ function WebhookSignatureGuard(options = {}) {
     let WebhookSignatureGuardMixin = class WebhookSignatureGuardMixin {
         canActivate(context) {
             var _a;
-            var _b;
-            const req = context.switchToHttp().getRequest();
+            const req = (0, jwt_request_helper_1.getHttpRequest)(context);
+            if (!req) {
+                return true;
+            }
             const secret = process.env[secretEnvVar];
             if (!secret) {
                 throw new common_1.UnauthorizedException('webhook_secret_not_configured');
@@ -27,12 +37,7 @@ function WebhookSignatureGuard(options = {}) {
             if (!provided || typeof provided !== 'string') {
                 throw new common_1.UnauthorizedException('webhook_signature_missing');
             }
-            const rawBody = (_b = req.rawBody) !== null && _b !== void 0 ? _b : req.body;
-            const payload = typeof rawBody === 'string'
-                ? rawBody
-                : Buffer.isBuffer(rawBody)
-                    ? rawBody
-                    : JSON.stringify(rawBody !== null && rawBody !== void 0 ? rawBody : {});
+            const payload = resolveWebhookRawBody(req.rawBody);
             const expected = (0, crypto_1.createHmac)(algorithm, secret)
                 .update(payload)
                 .digest('hex');

package/dist/guards/webhook-signature.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-signature.guard.js","sourceRoot":"","sources":["../../src/guards/webhook-signature.guard.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAMwB;AACxB,mCAAqD;AAQrD,+BACE,OAAO,GAAiC,EAAE;;IAE1C,MAAM,YAAY,SAAG,OAAO,CAAC,YAAY,mCAAI,wBAAwB,CAAC;IACtE,MAAM,UAAU,GAAG,OAAC,OAAO,CAAC,UAAU,mCAAI,qBAAqB,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/E,MAAM,SAAS,SAAG,OAAO,CAAC,SAAS,mCAAI,QAAQ,CAAC;IAGhD,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;QAC9B,WAAW,CAAC,OAAyB;;;YACnC,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,8BAAqB,CAAC,+BAA+B,CAAC,CAAC;YACnE,CAAC;YAED,MAAM,QAAQ,GAAG,MAAA,GAAG,CAAC,OAAO,0CAAG,UAAU,CAAC,CAAC;YAC3C,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC9C,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;YAC/D,CAAC;YAED,MAAM,OAAO,SAAG,GAAG,CAAC,OAAO,mCAAI,GAAG,CAAC,IAAI,CAAC;YACxC,MAAM,OAAO,GACX,OAAO,OAAO,KAAK,QAAQ;gBACzB,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;oBACxB,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,CAAC,CAAC;YAEtC,MAAM,QAAQ,GAAG,IAAA,mBAAU,EAAC,SAAS,EAAE,MAAM,CAAC;iBAC3C,MAAM,CAAC,OAAO,CAAC;iBACf,MAAM,CAAC,KAAK,CAAC,CAAC;YAEjB,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7C,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,cAAc,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,EAAE,CAAC;gBACpD,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,CAAC,IAAA,wBAAe,EAAC,cAAc,EAAE,cAAc,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;YAC/D,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAA;IApCK,0BAA0B;QAD/B,IAAA,mBAAU,GAAE;OACP,0BAA0B,CAoC/B;IAED,OAAO,0BAA0B,CAAC;AACpC,CAAC"}
+{"version":3,"file":"webhook-signature.guard.js","sourceRoot":"","sources":["../../src/guards/webhook-signature.guard.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAMwB;AACxB,mCAAqD;AACrD,qEAA8D;AAQ9D,+BAAsC,OAAgB;IACpD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;AAC/D,CAAC;AAED,+BACE,OAAO,GAAiC,EAAE;;IAE1C,MAAM,YAAY,SAAG,OAAO,CAAC,YAAY,mCAAI,wBAAwB,CAAC;IACtE,MAAM,UAAU,GAAG,OAAC,OAAO,CAAC,UAAU,mCAAI,qBAAqB,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/E,MAAM,SAAS,SAAG,OAAO,CAAC,SAAS,mCAAI,QAAQ,CAAC;IAGhD,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;QAC9B,WAAW,CAAC,OAAyB;;YACnC,MAAM,GAAG,GAAG,IAAA,mCAAc,EAAC,OAAO,CAAC,CAAC;YACpC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,8BAAqB,CAAC,+BAA+B,CAAC,CAAC;YACnE,CAAC;YAED,MAAM,QAAQ,GAAG,MAAA,GAAG,CAAC,OAAO,0CAAG,UAAU,CAAC,CAAC;YAC3C,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC9C,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;YAC/D,CAAC;YAED,MAAM,OAAO,GAAG,qBAAqB,CAAE,GAAW,CAAC,OAAO,CAAC,CAAC;YAE5D,MAAM,QAAQ,GAAG,IAAA,mBAAU,EAAC,SAAS,EAAE,MAAM,CAAC;iBAC3C,MAAM,CAAC,OAAO,CAAC;iBACf,MAAM,CAAC,KAAK,CAAC,CAAC;YAEjB,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7C,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,cAAc,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,EAAE,CAAC;gBACpD,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,CAAC,IAAA,wBAAe,EAAC,cAAc,EAAE,cAAc,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;YAC/D,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAA;IAlCK,0BAA0B;QAD/B,IAAA,mBAAU,GAAE;OACP,0BAA0B,CAkC/B;IAED,OAAO,0BAA0B,CAAC;AACpC,CAAC"}

package/dist/helper/auth.helper.js

@@ -48,6 +48,7 @@ const jwt_1 = require("@nestjs/jwt");
 const bcrypt = __importStar(require("bcryptjs"));
 const crypto_1 = require("crypto");
 const jwt_options_helper_1 = require("./jwt-options.helper");
+const escape_html_helper_1 = require("./escape-html.helper");
 let AuthHelper = class AuthHelper {
     constructor(jwt) {
         this.jwt = jwt;
@@ -99,6 +100,10 @@ let AuthHelper = class AuthHelper {
         return randomNumber.toString();
     }
     verifyEmailTemplateForOtp(fullName, username, otp, duration) {
+        const safeName = (0, escape_html_helper_1.escapeHtml)(fullName);
+        const safeUsername = (0, escape_html_helper_1.escapeHtml)(username);
+        const safeOtp = (0, escape_html_helper_1.escapeHtml)(otp);
+        const safeDuration = (0, escape_html_helper_1.escapeHtml)(duration);
         return `<!DOCTYPE html>
 <html lang="en">
   <head>
@@ -155,7 +160,7 @@ let AuthHelper = class AuthHelper {
                 font-weight: 500;
               "
             >
-              Hey ${fullName},
+              Hey ${safeName},
             </p>
             <p
               style="
@@ -168,7 +173,7 @@ let AuthHelper = class AuthHelper {
               Use the following OTP
               to complete the procedure to verify your email address. OTP is
               valid for
-              <span style="font-weight: 600; color: #1f1f1f;">${duration} minutes</span>.
+              <span style="font-weight: 600; color: #1f1f1f;">${safeDuration} minutes</span>.
               Do not share this code with others.
             </p>
             <p
@@ -189,7 +194,7 @@ let AuthHelper = class AuthHelper {
                 font-weight: 600;
               "
             >
-              ${username}
+              ${safeUsername}
             </p>
             <p
               style="
@@ -211,7 +216,7 @@ let AuthHelper = class AuthHelper {
                 background-color: #0d7801;
               "
             >
-              ${otp}
+              ${safeOtp}
             </p>
           </div>
         </div>

package/dist/helper/auth.helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.helper.js","sourceRoot":"","sources":["../../src/helper/auth.helper.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAmE;AACnE,qCAAyC;AACzC,MAAY,MAAM,qCAAiB;AACnC,mCAAmC;AAEnC,6DAG8B;AAGvB,IAAM,UAAU,GAAhB,MAAM,UAAU;IACrB,YAA6B,GAAe;mBAAf,GAAG;IAAe,CAAC;IAEzC,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,MAAc;QAC/C,MAAM,OAAO,GAAQ,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAA,0CAAqB,EAAC,MAAM,CAAC,CAAC,CAAC;QAE3E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,8BAAqB,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAGM,KAAK,CAAC,MAAM,CAAC,KAAa;QAC/B,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAGM,mBAAmB,CAAC,OAAY;QACrC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,mBACb,OAAO,GACZ,IAAA,wCAAmB,EAAC;YAClB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB;YAC3C,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAuC;SAC/D,CAAC,CACH,CAAC;IACJ,CAAC;IAGM,oBAAoB,CAAC,OAAY;QACtC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,mBACb,OAAO,GACZ,IAAA,wCAAmB,EAAC;YAClB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;YAC5C,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAwC;SAChE,CAAC,CACH,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,OAAY;QACrC,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACpD,IAAI,CAAC,GAAG,CAAC,SAAS,CAChB,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EACxC,IAAA,wCAAmB,EAAC;gBAClB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB;gBAC3C,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAuC;aAC/D,CAAC,CACH;YACD,IAAI,CAAC,GAAG,CAAC,SAAS,CAChB,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,EAClB,IAAA,wCAAmB,EAAC;gBAClB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;gBAC5C,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAwC;aAChE,CAAC,CACH;SACF,CAAC,CAAC;QAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;IACvC,CAAC;IAGM,kBAAkB,CACvB,aAAqB,EACrB,WAAmB;QAEnB,OAAO,MAAM,CAAC,WAAW,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IACxD,CAAC;IAGM,cAAc,CAAC,QAAgB;QACpC,MAAM,IAAI,GAAW,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAE5C,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAGM,WAAW;QAEhB,MAAM,YAAY,GAAG,IAAA,kBAAS,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,YAAY,CAAC,QAAQ,EAAE,CAAC;IACjC,CAAC;IAEM,yBAAyB,CAC9B,QAAgB,EAChB,QAAgB,EAChB,GAAW,EACX,QAAgB;QAEhB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAwDS,QAAQ;;;;;;;;;;;;;gEAaoC,QAAQ;;;;;;;;;;;;;;;;;;;;;gBAqBxD,QAAQ;;;;;;;;;;;;;;;;;;;;;;gBAsBR,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqGlB,CAAC;IACA,CAAC;CACF,CAAA;;qBAhTY,UAAU;IADtB,IAAA,mBAAU,GAAE;qCAEuB,gBAAU;GADjC,UAAU,CAgTtB"}
+{"version":3,"file":"auth.helper.js","sourceRoot":"","sources":["../../src/helper/auth.helper.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAmE;AACnE,qCAAyC;AACzC,MAAY,MAAM,qCAAiB;AACnC,mCAAmC;AAEnC,6DAG8B;AAC9B,6DAAkD;AAG3C,IAAM,UAAU,GAAhB,MAAM,UAAU;IACrB,YAA6B,GAAe;mBAAf,GAAG;IAAe,CAAC;IAEzC,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,MAAc;QAC/C,MAAM,OAAO,GAAQ,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAA,0CAAqB,EAAC,MAAM,CAAC,CAAC,CAAC;QAE3E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,8BAAqB,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAGM,KAAK,CAAC,MAAM,CAAC,KAAa;QAC/B,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAGM,mBAAmB,CAAC,OAAY;QACrC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,mBACb,OAAO,GACZ,IAAA,wCAAmB,EAAC;YAClB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB;YAC3C,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAuC;SAC/D,CAAC,CACH,CAAC;IACJ,CAAC;IAGM,oBAAoB,CAAC,OAAY;QACtC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,mBACb,OAAO,GACZ,IAAA,wCAAmB,EAAC;YAClB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;YAC5C,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAwC;SAChE,CAAC,CACH,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,OAAY;QACrC,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACpD,IAAI,CAAC,GAAG,CAAC,SAAS,CAChB,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EACxC,IAAA,wCAAmB,EAAC;gBAClB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB;gBAC3C,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAuC;aAC/D,CAAC,CACH;YACD,IAAI,CAAC,GAAG,CAAC,SAAS,CAChB,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,EAClB,IAAA,wCAAmB,EAAC;gBAClB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;gBAC5C,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAwC;aAChE,CAAC,CACH;SACF,CAAC,CAAC;QAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;IACvC,CAAC;IAGM,kBAAkB,CACvB,aAAqB,EACrB,WAAmB;QAEnB,OAAO,MAAM,CAAC,WAAW,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IACxD,CAAC;IAGM,cAAc,CAAC,QAAgB;QACpC,MAAM,IAAI,GAAW,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAE5C,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAGM,WAAW;QAEhB,MAAM,YAAY,GAAG,IAAA,kBAAS,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,YAAY,CAAC,QAAQ,EAAE,CAAC;IACjC,CAAC;IAEM,yBAAyB,CAC9B,QAAgB,EAChB,QAAgB,EAChB,GAAW,EACX,QAAgB;QAEhB,MAAM,QAAQ,GAAG,IAAA,+BAAU,EAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,IAAA,+BAAU,EAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAA,+BAAU,EAAC,GAAG,CAAC,CAAC;QAChC,MAAM,YAAY,GAAG,IAAA,+BAAU,EAAC,QAAQ,CAAC,CAAC;QAE1C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAwDS,QAAQ;;;;;;;;;;;;;gEAaoC,YAAY;;;;;;;;;;;;;;;;;;;;;gBAqB5D,YAAY;;;;;;;;;;;;;;;;;;;;;;gBAsBZ,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqGtB,CAAC;IACA,CAAC;CACF,CAAA;;qBArTY,UAAU;IADtB,IAAA,mBAAU,GAAE;qCAEuB,gBAAU;GADjC,UAAU,CAqTtB"}

package/dist/helper/escape-html.helper.d.ts

@@ -0,0 +1 @@
+export declare function escapeHtml(value: unknown): string;

package/dist/helper/escape-html.helper.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.escapeHtml = escapeHtml;
+function escapeHtml(value) {
+    return String(value !== null && value !== void 0 ? value : '')
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+//# sourceMappingURL=escape-html.helper.js.map

package/dist/helper/escape-html.helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"escape-html.helper.js","sourceRoot":"","sources":["../../src/helper/escape-html.helper.ts"],"names":[],"mappings":";;;AACA,oBAA2B,KAAc;IACvC,OAAO,MAAM,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC"}

package/dist/helper/jwt-request.helper.d.ts

@@ -0,0 +1,7 @@
+import { ExecutionContext } from '@nestjs/common';
+import { Request } from 'express';
+export declare const JWT_VERIFIED_SYMBOL: unique symbol;
+export declare function markJwtVerified(request: any): void;
+export declare function isJwtVerified(request: any): boolean;
+export declare function getHttpRequest(context: ExecutionContext): Request | undefined;
+export declare function extractBearerToken(request: Request): string | undefined;

package/dist/helper/jwt-request.helper.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JWT_VERIFIED_SYMBOL = void 0;
+exports.markJwtVerified = markJwtVerified;
+exports.isJwtVerified = isJwtVerified;
+exports.getHttpRequest = getHttpRequest;
+exports.extractBearerToken = extractBearerToken;
+exports.JWT_VERIFIED_SYMBOL = Symbol.for('zola.auth.verified');
+function markJwtVerified(request) {
+    if (request) {
+        request[exports.JWT_VERIFIED_SYMBOL] = true;
+    }
+}
+function isJwtVerified(request) {
+    return (request === null || request === void 0 ? void 0 : request[exports.JWT_VERIFIED_SYMBOL]) === true;
+}
+function getHttpRequest(context) {
+    if (context.getType() !== 'http') {
+        return undefined;
+    }
+    return context.switchToHttp().getRequest();
+}
+function extractBearerToken(request) {
+    var _a, _b;
+    var _c;
+    const [type, token] = (_c = (_b = (_a = request.headers) === null || _a === void 0 ? void 0 : _a.authorization) === null || _b === void 0 ? void 0 : _b.split(' ')) !== null && _c !== void 0 ? _c : [];
+    return type === 'Bearer' ? token : undefined;
+}
+//# sourceMappingURL=jwt-request.helper.js.map

package/dist/helper/jwt-request.helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-request.helper.js","sourceRoot":"","sources":["../../src/helper/jwt-request.helper.ts"],"names":[],"mappings":";;;;;;;AAIa,QAAA,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;AAEpE,yBAAgC,OAAY;IAC1C,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,QAAA,mBAAmB,CAAC,GAAG,IAAI,CAAC;IACtC,CAAC;AACH,CAAC;AAED,uBAA8B,OAAY;IACxC,OAAO,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAG,QAAA,mBAAmB,CAAC,MAAK,IAAI,CAAC;AACjD,CAAC;AAED,wBAA+B,OAAyB;IACtD,IAAI,OAAO,CAAC,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;QACjC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;AAC7C,CAAC;AAED,4BAAmC,OAAgB;;;IACjD,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,SAAG,MAAA,MAAA,OAAO,CAAC,OAAO,0CAAE,aAAa,0CAAE,KAAK,CAAC,GAAG,CAAC,mCAAI,EAAE,CAAC;IACvE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC"}

package/dist/helper/validate-jwt-env.helper.d.ts

@@ -1,4 +1,5 @@
 export type ValidateJwtEnvOptions = {
     required?: boolean;
+    minSecretLength?: number;
 };
 export declare function validateJwtEnv(options?: ValidateJwtEnvOptions): void;

package/dist/helper/validate-jwt-env.helper.js

@@ -1,16 +1,31 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.validateJwtEnv = validateJwtEnv;
+const DEFAULT_MIN_SECRET_LENGTH = 32;
+function assertNonEmpty(name, value) {
+    if (!(value === null || value === void 0 ? void 0 : value.trim())) {
+        throw new Error(`${name} is required`);
+    }
+    return value.trim();
+}
+function assertMinLength(name, value, minLength) {
+    if (value.length < minLength) {
+        throw new Error(`${name} must be at least ${minLength} characters`);
+    }
+}
 function validateJwtEnv(options = {}) {
-    const { required = true } = options;
+    const { required = true, minSecretLength = DEFAULT_MIN_SECRET_LENGTH } = options;
     if (!required) {
         return;
     }
-    if (!process.env.JWT_ACCESS_TOKEN_SECRET) {
-        throw new Error('JWT_ACCESS_TOKEN_SECRET is required');
-    }
-    if (!process.env.JWT_REFRESH_TOKEN_SECRET) {
-        throw new Error('JWT_REFRESH_TOKEN_SECRET is required');
+    const accessSecret = assertNonEmpty('JWT_ACCESS_TOKEN_SECRET', process.env.JWT_ACCESS_TOKEN_SECRET);
+    const refreshSecret = assertNonEmpty('JWT_REFRESH_TOKEN_SECRET', process.env.JWT_REFRESH_TOKEN_SECRET);
+    assertMinLength('JWT_ACCESS_TOKEN_SECRET', accessSecret, minSecretLength);
+    assertMinLength('JWT_REFRESH_TOKEN_SECRET', refreshSecret, minSecretLength);
+    if (accessSecret === refreshSecret) {
+        throw new Error('JWT_ACCESS_TOKEN_SECRET and JWT_REFRESH_TOKEN_SECRET must differ');
     }
+    assertNonEmpty('JWT_ACCESS_TOKEN_EXPIRES', process.env.JWT_ACCESS_TOKEN_EXPIRES);
+    assertNonEmpty('JWT_REFRESH_TOKEN_EXPIRES', process.env.JWT_REFRESH_TOKEN_EXPIRES);
 }
 //# sourceMappingURL=validate-jwt-env.helper.js.map

package/dist/helper/validate-jwt-env.helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate-jwt-env.helper.js","sourceRoot":"","sources":["../../src/helper/validate-jwt-env.helper.ts"],"names":[],"mappings":";;;AAKA,wBAA+B,OAAO,GAA0B,EAAE;IAChE,MAAM,EAAE,QAAQ,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;IACT,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC"}
+{"version":3,"file":"validate-jwt-env.helper.js","sourceRoot":"","sources":["../../src/helper/validate-jwt-env.helper.ts"],"names":[],"mappings":";;;AAOA,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC,SAAS,cAAc,CAAC,IAAY,EAAE,KAAyB;IAC7D,IAAI,EAAC,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,IAAI,EAAE,CAAA,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,KAAa,EAAE,SAAiB;IACrE,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,qBAAqB,SAAS,aAAa,CACnD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,wBAA+B,OAAO,GAA0B,EAAE;IAChE,MAAM,EAAE,QAAQ,GAAG,IAAI,EAAE,eAAe,GAAG,yBAAyB,EAAE,GACpE,OAAO,CAAC;IACV,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;IACT,CAAC;IAED,MAAM,YAAY,GAAG,cAAc,CACjC,yBAAyB,EACzB,OAAO,CAAC,GAAG,CAAC,uBAAuB,CACpC,CAAC;IACF,MAAM,aAAa,GAAG,cAAc,CAClC,0BAA0B,EAC1B,OAAO,CAAC,GAAG,CAAC,wBAAwB,CACrC,CAAC;IAEF,eAAe,CAAC,yBAAyB,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;IAC1E,eAAe,CAAC,0BAA0B,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC;IAE5E,IAAI,YAAY,KAAK,aAAa,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;IAED,cAAc,CACZ,0BAA0B,EAC1B,OAAO,CAAC,GAAG,CAAC,wBAAwB,CACrC,CAAC;IACF,cAAc,CACZ,2BAA2B,EAC3B,OAAO,CAAC,GAAG,CAAC,yBAAyB,CACtC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -14,6 +14,7 @@ export * from './strategy/jwt.strategy';
 export * from './models/auth.model';
 export * from './helper/jwt.type';
 export * from './helper/jwt-options.helper';
+export * from './helper/jwt-request.helper';
 export * from './helper/validate-jwt-env.helper';
 export * from './helper/get-client-ip.helper';
 export * from './authorization-error-response.type';

package/dist/index.js

@@ -33,6 +33,7 @@ __exportStar(require("./strategy/jwt.strategy"), exports);
 __exportStar(require("./models/auth.model"), exports);
 __exportStar(require("./helper/jwt.type"), exports);
 __exportStar(require("./helper/jwt-options.helper"), exports);
+__exportStar(require("./helper/jwt-request.helper"), exports);
 __exportStar(require("./helper/validate-jwt-env.helper"), exports);
 __exportStar(require("./helper/get-client-ip.helper"), exports);
 __exportStar(require("./authorization-error-response.type"), exports);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,+DAA6D;AAApD,2HAAA,mBAAmB,OAAA;AAC5B,gDAA8C;AAArC,qGAAA,QAAQ,OAAA;AACjB,yEAAuD;AACvD,sEAAoD;AACpD,6DAA2C;AAC3C,uDAAqC;AACrC,6DAA2C;AAC3C,yDAAuC;AACvC,mEAAiD;AACjD,wDAAsC;AACtC,8DAA4C;AAC5C,wEAAsD;AACtD,0DAAwC;AACxC,sDAAoC;AACpC,oDAAkC;AAClC,8DAA4C;AAC5C,mEAAiD;AACjD,gEAA8C;AAC9C,sEAAoD"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,+DAA6D;AAApD,2HAAA,mBAAmB,OAAA;AAC5B,gDAA8C;AAArC,qGAAA,QAAQ,OAAA;AACjB,yEAAuD;AACvD,sEAAoD;AACpD,6DAA2C;AAC3C,uDAAqC;AACrC,6DAA2C;AAC3C,yDAAuC;AACvC,mEAAiD;AACjD,wDAAsC;AACtC,8DAA4C;AAC5C,wEAAsD;AACtD,0DAAwC;AACxC,sDAAoC;AACpC,oDAAkC;AAClC,8DAA4C;AAC5C,8DAA4C;AAC5C,mEAAiD;AACjD,gEAA8C;AAC9C,sEAAoD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zola_do/authorization",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "description": "JWT auth, guards, strategies for NestJS",
   "author": "zolaDO",
   "license": "ISC",